Crash report: https://crash-stats.mozilla.org/report/index/f3ca524e-8f0f-4db4-9078-194810211120

MOZ_CRASH Reason: ```error marshalling arguments for start_drag (signature ?oo?ou): null value passed for arg 1

Top 10 frames of crashing thread:

0 libxul.so libxul.so@0x314a803
1 libwayland-client.so.0 libwayland-client.so.0@0x9b7b
2 libwayland-client.so.0 libwayland-client.so.0@0x66b2
3 libwayland-client.so.0 libwayland-client.so.0@0x6606
4 libwayland-client.so.0 libwayland-client.so.0@0x686f
5 firefox firefox@0x133ca
6 libglib-2.0.so.0 libglib-2.0.so.0@0x61b42
7 libgdk-3.so.0 libgdk-3.so.0@0xd881f
8 firefox firefox@0x13630
9 libgdk-3.so.0 libgdk-3.so.0@0x39979

Platform Linux (Ubuntu) with Wayland (compositor: Mutter) (Firefox from Snap)
On touch screen

Step to reproduce: 
* Open bookmarks
* touch a bookmark and drag it
* Firefox crashed

Linux Kernel: 5.13.0-21-generic x86_64
Distro: Ubuntu: 21.10
Wayland compositor: Mutter
Firefox: 94.0.1

Hey Thierry,
Can you test the issue while in Safe Mode? You can find helpful info here : https://support.mozilla.org/en-US/kb/troubleshoot-firefox-issues-using-safe-mode .
Also a fresh new profile could help. You can find more about creating a new profile here : https://support.mozilla.org/en-US/kb/troubleshoot-and-diagnose-firefox-problems#w_6-create-a-new-firefox-profile .
If possible, you can test this issue on the nightly build as well. Download the build from : https://www.mozilla.org/en-US/firefox/nightly/all/ .

Ok, so:

• In Safe Mode (with Firefox 94.0.2) : I reproduce : Firefox crash

• with Nightly (96.0a1) : that's OK : Firefox Nightly don't crash if I drag a bookmark

The Bugbug bot thinks this bug should belong to the 'Core::Widget: Gtk' component, and is moving the bug to that component. Please revert this change in case you think the bot is wrong.

Thanks for the report!

(In reply to Thierry Houllier from comment #3)

Ok, so:

• In Safe Mode (with Firefox 94.0.2) : I reproduce : Firefox crash

• with Nightly (96.0a1) : that's OK : Firefox Nightly don't crash if I drag a bookmark

Did you test Nightly (96.0a1) under Wayland (with MOZ_ENABLE_WAYLAND=1) ?
Thanks.

(In reply to Martin Stránský [:stransky] (ni? me) from comment #6)

(In reply to Thierry Houllier from comment #3)

• with Nightly (96.0a1) : that's OK : Firefox Nightly don't crash if I drag a bookmark

Did you test Nightly (96.0a1) under Wayland (with MOZ_ENABLE_WAYLAND=1) ?
Thanks.

Oh my bad! No ...
I just re-test with MOZ_ENABLE_WAYLAND=1 on Nightly 96.0a1 (2011-11-29) and ... that crashed ...

Also seeing this crash in Wayland mode. Reproducible as long as I don't start in safe mode.

So this crashes only when popups are opened, right?
If so, can you add widget.use-move-to-rect bool key at about:config and set it to false and retest?
Thanks.

(In reply to Martin Stránský [:stransky] (ni? me) from comment #9)

So this crashes only when popups are opened, right?

It's when the Menu>Bookmarks is open and you drag and drop when of the bookmarks

If so, can you add widget.use-move-to-rect bool key at about:config and set it to false and retest?

So: on Nightly 97.0a1 (2021-12-08) I have add widget.use-move-to-rect and set it to "false" ... result : crash

Can you please attach crash ID from latest Nightly? See
https://fedoraproject.org/wiki/Debugging_guidelines_for_Mozilla_products#Using_Mozilla_crash_reporter
Thanks.

(In reply to Martin Stránský [:stransky] (ni? me) from comment #11)

Can you please attach crash ID from latest Nightly? See
https://fedoraproject.org/wiki/Debugging_guidelines_for_Mozilla_products#Using_Mozilla_crash_reporter
Thanks.

Crash id : 2e27eb5d-91f4-4617-853a-1d7950211217
(with Nighlty 97.0a1 (2021-12-17) )

I think I am seeing the same problem on Wayland (sway) on ArchLinux. I can reproduce this crash in the same ways as reported by Thierry.
For me it also happens when I click on a tab and start to drag it. This crash also happens when there are no popups open.

Here are some crash logs with the latest nightly on a freshly created profile (98.0a1 2022-01-12):

bp-6df01f11-5ee8-40be-a8b6-2dee80220112
bp-5f32e20a-f610-4e59-967d-5eda60220112
bp-fb6d8bdc-0026-4a19-955f-85c2e0220112
bp-3ff2cd09-b3f7-4aed-a7c8-0ccc80220112

I can reproduce it with Nightly 99 (Wayland) simply by doing a drag and drop of an image from Nautilus into a Slack or Matrix channel.

The bug has a crash signature, thus the bug will be considered confirmed.

Dragging still crashes Firefox on the latest nightly for me. Could this be the same bug or should I file a new bug?

[Parent 15924, Main Thread] WARNING: gdk_wayland_window_get_wl_surface: assertion 'GDK_IS_WAYLAND_WINDOW (window)' failed: 'glib warning', file /builds/worker/checkouts/gecko/toolkit/xre/nsSigHandlers.cpp:167

(firefox-nightly:15924): Gdk-CRITICAL **: 00:53:04.454: gdk_wayland_window_get_wl_surface: assertion 'GDK_IS_WAYLAND_WINDOW (window)' failed
ExceptionHandler::GenerateDump cloned child 16362
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...

(In reply to Julian Rüth from comment #17)

Dragging still crashes Firefox on the latest nightly for me. Could this be the same bug or should I file a new bug?

[Parent 15924, Main Thread] WARNING: gdk_wayland_window_get_wl_surface: assertion 'GDK_IS_WAYLAND_WINDOW (window)' failed: 'glib warning', file /builds/worker/checkouts/gecko/toolkit/xre/nsSigHandlers.cpp:167

(firefox-nightly:15924): Gdk-CRITICAL **: 00:53:04.454: gdk_wayland_window_get_wl_surface: assertion 'GDK_IS_WAYLAND_WINDOW (window)' failed
ExceptionHandler::GenerateDump cloned child 16362
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...

Please attach crash ID:
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Collect_information_for_a_bug_report

Thanks.

I uploaded a crash report, the crash id is 6cc63d8a-5fed-4cb8-a387-e6f360220523.

Sorry, I think I did not actually use nightly when the crash happened. Here's a crash report with Firefox nightly: bp-47219e02-4622-4d9b-8a09-f41640220523

Can you reproduce that reliably? If so, can you run firefox with MOZ_LOG="WidgetPopup:5 WidgetDrag:5" env variables and attach the log here?
Thanks.

Yes, I can reproduce this by dragging a tab. It always crashes.

When I set these environment variables, I get the following output on the terminal:

[Parent 212721: Main Thread]: D/WidgetDrag nsDragService::nsDragService
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf1bfb9800]:   mBounds: x:0 y:0 w:0 h:0
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf1bfb9800]: nsWindow::Create() Popup
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf1bfb9800]:     set parent window [7fcf4628ec00] browser
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf1bfb9800]:   nsWindow type 3
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf1bfb9800]:   mShell 7fcf1dec4b60 mContainer 7fcf18a61150 mGdkWindow 0 XID 0x0
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]:   mBounds: x:0 y:0 w:0 h:0
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]: nsWindow::Create() Popup
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]: nsWindow::Create() Drag popup
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]:     set parent window [7fcf4628ec00] browser
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]:   set commit to parent
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]:   nsWindow type 3
[Parent 212721: Main Thread]: D/WidgetPopup [7fcf18d64000]:   mShell 7fcf1fb20360 mContainer 7fcf18a61690 mGdkWindow 0 XID 0x0
[Parent 212721: Main Thread]: D/WidgetDrag nsDragService::InvokeDragSession
[Parent 212721: Main Thread]: D/WidgetDrag adding target application/x-moz-tabbrowser-tab
[Parent 212721: Main Thread]: D/WidgetDrag adding target text/x-moz-text-internal
[Parent 212721, Main Thread] WARNING: gdk_wayland_window_get_wl_surface: assertion 'GDK_IS_WAYLAND_WINDOW (window)' failed: 'glib warning', file /builds/worker/checkouts/gecko/toolkit/xre/nsSigHandlers.cpp:167

(firefox-nightly:212721): Gdk-CRITICAL **: 13:01:57.523: gdk_wayland_window_get_wl_surface: assertion 'GDK_IS_WAYLAND_WINDOW (window)' failed
ExceptionHandler::GenerateDump cloned child 212990
ExceptionHandler::SendContinueSignalToChild sent continue signal to child
ExceptionHandler::WaitForContinueSignal waiting for continue signal...
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.
Exiting due to channel error.

The crash report for this run is at 27133647-4c2d-4a63-9687-da7db0220523

Julian, can you try a different compositor? (mutter/kwin):
https://fedoraproject.org/wiki/How_to_debug_Firefox_problems#Testing_different_Wayland_compositor
Thanks.

I cannot reproduce the problem with mutter, it works as it should there.

I could not start kwin as described in the link you posted, it segfaults before I even get to start firefox.

Do you want me to try anything else?

(In reply to Julian Rüth from comment #24)

I cannot reproduce the problem with mutter, it works as it should there.

I could not start kwin as described in the link you posted, it segfaults before I even get to start firefox.

Do you want me to try anything else?

Please report that at sway bug tracker - seems to be a bug in Sway Wayland compositor and not in Firefox itself.
Thanks.

Trying to report this for sway, I found that the problem is caused by squeekboard which I had running in the background. Without squeekboard, everything works fine :)

I'll report at squeekboard then.

Okay, Thanks.